What is the CVSS score of CVE-2026-32025?

CVE-2026-32025 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-32025?

OpenClaw deployments are vulnerable to authentication bypass attacks that could allow attackers to gain unauthorized access to control-plane operations by tricking users into visiting malicious…. A patch is available.

How to fix or mitigate CVE-2026-32025?

Within 24 hours: Identify and inventory all OpenClaw deployments, document affected versions, and restrict WebSocket access to trusted networks only. Within 7 days: Implement network segmentation to isolate loopback interfaces, disable WebSocket browser clients if operationally feasible, and deploy WAF rules to block suspicious origin headers. Within 30 days: Monitor vendor communications for patch availability, conduct user awareness training on phishing risks, and evaluate alternative authentication mechanisms or gateway solutions.

Openclaw CVE-2026-32025

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-19 disclosure@vulncheck.com

GHSA-jmmg-jqc7-5qf4

Authentication Bypass Openclaw

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-force attacks against the gateway to establish an authenticated operator session and invoke control-plane methods.

AnalysisAI

A WebSocket authentication bypass vulnerability in OpenClaw gateway software allows attackers to circumvent origin validation and rate limiting protections when deployed on localhost/loopback interfaces. The flaw enables malicious websites to conduct brute-force attacks against the gateway's authentication mechanism through a victim's browser, potentially gaining full administrative control over the OpenClaw control plane. With a 7.5 CVSS score and requiring only user interaction to exploit, this represents a significant risk for organizations running OpenClaw in loopback configurations.

Technical ContextAI

OpenClaw is a gateway or control plane software that uses WebSocket connections for browser-based client communication. The vulnerability stems from improper enforcement of origin checks (CWE-307: Improper Restriction of Excessive Authentication Attempts) specifically affecting loopback deployments where the service runs on localhost or 127.0.0.1. When browsers connect to WebSocket endpoints on loopback addresses, the Same-Origin Policy enforcement can be inconsistent, and OpenClaw versions before 2026.2.25 fail to properly validate the origin header or implement adequate authentication throttling for these connections. This allows cross-origin requests from malicious websites to bypass security controls that would normally prevent unauthorized access attempts.

RemediationAI

Upgrade OpenClaw to version 2026.2.25 or later, which contains the fix documented in commit c736f11a16d6bc27ea62a0fe40fffae4cb071fdb. For immediate mitigation before patching, avoid running OpenClaw on loopback interfaces or implement additional authentication layers such as reverse proxy authentication. Organizations should review the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-jmmg-jqc7-5qf4 and the detailed vulnerability analysis at https://www.vulncheck.com/advisories/openclaw-password-brute-force-via-browser-origin-websocket-authentication-bypass for complete remediation guidance.